Symantec Antivirus Engine Flaw makes it Vulnerable to Hack

Symantec Antivirus Engine was detected with an easy to exploit flaw which makes it vulnerable to hack. This flaw can be easily exploited by hackers to compromise the Computer systems. The flaw consists of a buffer overflow condition that could be triggered when parsing executable files with malformed headers.

The flaw has been fixed by Symantec in Anti-Virus Engine (AVE) version 20151.1.1.4, released Monday via Live Update. According to Google security engineer Tavis Ormandy, who found the flaw, the vulnerability can be exploited remotely to execute malicious code on computers. All it takes is for the attacker to send an email with the exploit file as attachment or to convince the user to visit a malicious link.Executing the file is not necessary, because the antivirus engine uses a driver to intercept all system input and output operations and will automatically scan the file as soon as it reaches the file system in any way.The file extension doesn’t matter, as long as the file has a header identifying it as a portable executable file packed with AS Pack, a commercial compressor utility.

Symantec AVE unpacks such files inside the kernel, the highest privileged region of the OS, this means that successful exploitation can lead to a full system compromise which is the worst part.

“On Linux, Mac and other UNIX platforms, this results in a remote heap overflow as root in the Symantec or Norton process,” Ormandy said in an advisory. “On Windows, this results in kernel memory corruption, as the scan engine is loaded into the kernel, making this a remote memory corruption vulnerability.

In the Common Vulnerability Scoring System (CVSS) Symantec has rated the vulnerability with a 9.1 severity score out of 10.”The most common symptom of a successful attack would result in an immediate system crash, aka. Blue Screen of Death (BSOD),” the company said in its own advisory.

This is the latest in a long string of critical vulnerabilities found by Ormandy and other security researchers in antivirus products in recent years. Most of them have criticized antivirus vendors for continuing to perform dangerous file scanning operations, which historically have resulted in vulnerabilities, using kernel privileges.